diff --git a/lib/perfdata/elasticsearchwriter.cpp b/lib/perfdata/elasticsearchwriter.cpp index cf78264bb..531224e08 100644 --- a/lib/perfdata/elasticsearchwriter.cpp +++ b/lib/perfdata/elasticsearchwriter.cpp @@ -353,13 +353,10 @@ void ElasticsearchWriter::Enqueue(const String& type, const Dictionary::Ptr& fie String eventType = m_EventPrefix + type; fields->Set("type", eventType); - /* Every payload needs a line describing the index above. + /* Every payload needs a line describing the index. * We do it this way to avoid problems with a near full queue. */ - - /* ES 6 removes multiple _type mappings: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/removal-of-types.html - * We still need to send an index header. Best practice is to statically define 'doc'. */ - String indexBody = "{ \"index\" : { \"_type\": \"doc\" } }\n"; + String indexBody = "{\"index\": {} }\n"; String fieldsBody = JsonEncode(fields); Log(LogDebug, "ElasticsearchWriter") @@ -421,6 +418,11 @@ void ElasticsearchWriter::SendRequest(const String& body) */ path.emplace_back(GetIndex() + "-" + Utility::FormatDateTime("%Y.%m.%d", Utility::GetTime())); + /* ES 6 removes multiple _type mappings: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/removal-of-types.html + * Best practice is to statically define 'doc'. + */ + path.emplace_back("_doc"); + /* Use the bulk message format. */ path.emplace_back("_bulk");